Orchestration Layers Give CIOs A Place To Enforce Agent Authority

Identity and access management was built around people and applications. A person gets a role, an application gets a service account, and entitlements are reviewed on a schedule. AI agents break that arrangement in two places: they act without a person initiating each step, and they can hand work to other agents. An agent can pass the access it holds to another agent that was never scoped for it. In July, models running inside an OpenAI cyber evaluation exploited a zero-day to escape their test environment and escalated privileges until they reached the open internet. They then compromised production infrastructure at Hugging Face, chasing the answers to their own benchmark.

Arvinda Rao is Director of Compliance at Veeam, where his work spans AI governance, responsible AI, security, privacy, and risk. He has more than 16 years in risk and compliance, including roles at IBM and Accenture. He helped build the Data Command Center at Securiti, the data and AI governance company Veeam acquired in December 2025. In any agent deployment, he looks first at the data the agent can reach.

"It sounds scary that agent A can authorize access to agent B, and then agent B can authorize access to agent C. There is no end. You don't know what it is thinking, whether it has understood or misunderstood your command, or where it is going," said Rao. For now, he advised against one agent granting access to another at all. Only a human can judge what a second agent is capable of, and that judgment has to happen before the access moves.

• Least privilege for agents: Enterprise IT has long granted employees time-bound access scoped to the job in front of them. Rao argued that agents raise the stakes, because an agent's reach is hard to predict before it starts working. "They can test one level of access, approach other agents, upload a file, and borrow the privileges and permissions of those agents to go and exploit," Rao said. The difference he points to is judgment. A person given a task knows roughly where its limits sit, and an agent can act without knowing.

• Agents outside the inventory: Least privilege assumes a known list of identities to scope. Employees connect AI tools without procurement or a security review, and close to half of workers report adopting them without employer approval. "The companies don't know what agents are running unless they do the inventory scan every now and then," Rao said. "You have humans using AI for their day-to-day tasks and downloading something, and you don't know what's happening behind the scenes."

Scanning and scoping establish what agents exist and what they can reach. Rao placed the human checkpoints by weighing consequences, and a code pipeline shows how that reasoning works. An agent writes the code, another reviews it, another tests it against the use cases, and the work moves through all three at speed. "You don't need human involvement in each and every bit of what the process involves, but is it a critical factor?" Rao said. "Before pushing a PR into production, you need a human review, human eyes, because AI learns what the critical factors are, and to begin with it may not know what to check."

• A human check on delegation: Agent A may lack the skills for part of a task and choose agent B from the ecosystem to cover it. Rao lets the choice of agent stand and sends the access grant back to a person. "You build a system where, when agent A decides agent B is the right candidate and should have this access, there should be a human check," Rao explained. "It comes back to the person using it and says agent B needs to have this access. Is it the right thing to do?"

• Intent and data: A delegation request has to carry enough information for a policy engine to approve or deny it without a person reading the surrounding context. "The main thing would be objective, intent, and then what data and systems," Rao said. "I would give more focus on intent and then the data underneath, because the way I look at everything is what is the data. That's the bottom line."

The obvious objection is that human approval on every delegation rebuilds the manual process agents were brought in to remove, and teams running these systems report that bottleneck. Rao expects the volume of approvals to fall as the work goes on. An access decision holds for a period before it returns at review, so the same grant does not go back for approval every time it is used. He compared the progression to tiered technical support, where level three work moves down to level two and level two work moves to level one. "If you compare an engineer who is out of college, you don't give entire access to the production system on day one," Rao explained. "You give him some task, you monitor him, and you know what the person is capable of."

• Shared responsibility: Responsibility for the controls around an agent doesn't sit entirely inside the enterprise. Few teams build the whole stack themselves, and a hybrid deployment splits the work between the vendor hosting the infrastructure and models and the team configuring what runs on top. "I would rely on the foundation model providers for their models. I'm not worried about it," Rao said. "What I need to be worried about is the agent I am building on top of it, what kind of data I am using, what access I'm giving to the agent, and how I am training my agent." He sets a higher bar for anything a client touches than for internal use.

The human approval on a delegation and the review before a change reaches production both have to run somewhere in the stack. Rao places them in the orchestration layer, the part that already moves work between applications, APIs, and data systems. A policy held outside that flow depends on someone remembering to consult it. Building those checks starts with the use case, since the steps that matter in a code pipeline differ from the ones that matter in a customer workflow. "Based on that use case, you identify what are the critical checks, what are the different elements, you measure that, and then only flag the critical and high ones," Rao concluded. "For those elements you define a flow in your orchestration layer saying these are the ones which need human intervention at the earliest."